by Kastro
Paper/Archive/CVE-2026-56000

CVE-2026-56000

X.Org xorg-x11-server — xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
32
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 23.6.236 × 204.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

Affected

ProductAffectedFixed inSource
xorg-x11-server< 21.1.2421.1.24CNA
xwayland< 24.1.1324.1.13CNA

Scores by source

suse (CNA)9.0CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043advisoryopenwall.com/lists/oss-security/2026/07/08/2